Cyber Security Daily Radar

#severity:medium

共收录 5506 条相关情报。

← 返回所有主题
漏洞预警2026-10-28 发布MEDIUM

Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters suc...

CVE-2026-118662

Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate se

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-180#cwe-284#npm#severity:medium
安全公告2026-10-28 发布INFO

Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim

CVE-2026-115910

### Summary The generic OpenID Connect backend (`OpenIdConnectAuth` and every backend built on it) stores the `nonce` i

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-345#cwe-384#pip#severity:medium
安全公告2026-10-28 发布INFO

ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

CVE-2026-115920

## Summary ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than thr

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-125#pip#severity:medium
安全公告2026-10-28 发布INFO

ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs

CVE-2026-115922

## Summary ONNX's Python tensor-materialization helpers could allocate memory according to attacker-controlled tensor d

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-789#pip#severity:medium
安全公告2026-10-28 发布INFO

ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

CVE-2026-115921

## Summary ONNX shape inference did not safely validate the required Scan `num_scan_inputs` attribute. Two malformed va

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-195#cwe-476#pip#severity:medium
安全公告2026-10-28 发布INFO

ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

CVE-2026-115919

## Summary ONNX shape inference performed an out-of-bounds read when processing a malformed RNN, GRU, or LSTM node from

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-125#pip#severity:medium
安全公告2026-10-28 发布INFO

Go JOSE: Panics in JSON parsing

CVE-2026-116586

### Summary Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash. Note: th

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-674#go#severity:medium
漏洞预警2026-10-28 发布LOW

go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter ...

CVE-2026-118681

go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-288#severity:medium
漏洞预警2026-10-28 发布MEDIUM

SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBAL...

CVE-2026-118680

SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-22#severity:medium
漏洞预警2026-10-28 发布HIGH

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Sla...

CVE-2026-118679

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhoo

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-918#severity:medium
漏洞预警2026-10-28 发布MEDIUM

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its deep-link connect handler to silently r...

CVE-2026-118677

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop ap

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-939#severity:medium
漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by omitting default node pa...

CVE-2026-118676

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use c

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-863#severity:medium
漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-wor...

CVE-2026-118675

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared w

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-863#severity:medium
漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw requ...

CVE-2026-118647

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error ex

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-532#severity:medium
漏洞预警2026-10-28 发布HIGH

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error wor...

CVE-2026-118644

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-266#severity:medium
漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, a...

CVE-2026-118643

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-209#severity:medium
漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workf...

CVE-2026-118642

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-863#severity:medium
漏洞预警2026-10-28 发布MEDIUM

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows chat-only users to register restricted tool types. Users with the ...

CVE-2026-118640

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows chat-only

来源摘录 · NVD / GitHub Advisory

#advisory#cve#cwe-863#severity:medium
漏洞预警2026-10-28 发布MEDIUM

Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a malicious file. (C...

CVE-2026-106484

Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker

来源摘录 · NVD / OSV.dev / GitHub Advisory

#advisory#cve#cwe-284#severity:medium
安全公告2026-10-28 发布INFO

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP()...

CVE-2026-118376

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-p

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-918#severity:medium